Node.js + Flutter Dev — Phase 1 Hardening of a Real-Money Betting/Gambling Game (Prototype → Stable)

I have a working prototype of a real-money betting/gambling multiplayer mobile game — players join staked, real-time tournaments and the winner takes the pot minus a house fee. I want to start with a well-defined Phase 1 to make it stable and reliable. Further phases will follow with the right developer.

The core already works
Server-authoritative game engine in Node.js (Express, Socket.IO) — all game logic server-side.
Real-time staked tournaments (2–10 players) with matchmaking and safe stake debit/refund.
Phone + PIN auth (SMS), wallet (deposits via Payline/Monext, withdrawal requests, transactions).
Flutter app (Android/iOS/Web) with the full gameplay UI.
Basic admin back-office. 58 passing backend tests.
Stack: Node.js 22, Express 4, Socket.IO 4, MySQL 8, Flutter (Riverpod, dio, socket_io_client), PM2/Linux.

Phase 1 scope (this contract)
Codebase audit — short written report on architecture, risks, and a prioritized roadmap.
Deposit flow hardening — reliable server-side payment confirmation via provider webhook (replace the current manual "verify" step) and a cleaner in-app deposit experience.
Reliability — persist and recover live game state so tournaments survive a server restart; graceful player reconnection/resume instead of instant elimination on disconnect.
Push notifications (FCM/APNs) for "match found" and "your turn".
Basic hardening — move secrets/banking data out of logs, add error tracking/monitoring, and add integration tests around the payment and reconnection flows.
Out of scope for Phase 1 (planned for later phases)
KYC/AML onboarding, age verification, responsible-gaming controls, automated withdrawals, anti-collusion systems, and App Store / Play Store submission.

Deliverables & acceptance
The audit report (item 1) delivered as a written document.
Items 2–5 merged to the main branch, working on a staging deployment, with the new integration tests passing.
Acceptance = a deposit confirmed end-to-end via webhook, a tournament that survives a server restart, a player that reconnects mid-game, and push notifications received on Android & iOS.
Required skills
Strong Node.js + Socket.IO (real-time, server-authoritative).
MySQL with transactional money handling (no floats).
Flutter/Dart (Android/iOS/Web).
Payment-gateway / webhook integration.
Plus: prior real-money, betting/gambling, or fintech experience.
Terms
Budget: €1,500 (fixed price, Phase 1)
Timeline: 1 month
Intended as the first milestone of a longer engagement for the right developer.
To apply
Share relevant real-money or real-time multiplayer projects (links), your take on the biggest risk in Phase 1, and your availability. Private repo and walkthrough for shortlisted candidates.